Securing OpenAI Codex with TrueFoundry

#!/bin/bash
# MDM Deployment Script: OpenAI Codex, macOS (arm64 + amd64)
# Must be run as root.

set -euo pipefail

[[ "$(id -u)" -ne 0 ]] && { echo "ERROR: Must be run as root." >&2; exit 1; }

CONFIG_FILE="/Library/Preferences/com.truefoundry.tfy-local-ai-setup.conf"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }

# ---------------------------------------------------------------------------
# Config: fill in on first run. Values are saved to ${CONFIG_FILE} and
# reloaded automatically on subsequent runs, so no edits are needed after
# that. To update a value later, set it here and run the script once more.
# ---------------------------------------------------------------------------
GATEWAY_URL="<your-gateway-url>"
CONTROL_PLANE_URL="<your-control-plane-url>"
TENANT_NAME="<your-tenant-name>"

# Optional: gateway URL override for Codex (defaults to GATEWAY_URL if not set)
# CODEX_GATEWAY_URL=""

# Optional: Codex auth flow. "api-key" (default) or "chatgpt-subscription".
# See "Using Codex MDM with a ChatGPT Business or Enterprise subscription" below.
# CODEX_AUTH_MODE="api-key"

# Optional: default model for Codex (a virtual model slug is recommended).
# If unset, no model key is written and developers choose their own.
# CODEX_DEFAULT_MODEL="gpt-5.2-codex"

# Optional: path to a TOML template that the provider block is injected into
# CODEX_SETTINGS_FILE="/etc/tfy/base-codex-config.toml"

# ---------------------------------------------------------------------------
# Load + save config (before binary install)
# ---------------------------------------------------------------------------
# Fill in any placeholder values from the saved config file
if [[ -f "${CONFIG_FILE}" ]]; then
  while IFS='=' read -r _key _value; do
    [[ -z "${_key}" || "${_key}" == \#* ]] && continue
    _key="${_key// /}"; _value="${_value%\"}"; _value="${_value#\"}"
    case "${_key}" in
      GATEWAY_URL)       [[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && GATEWAY_URL="${_value}" ;;
      CONTROL_PLANE_URL) [[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && CONTROL_PLANE_URL="${_value}" ;;
      TENANT_NAME)       [[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && TENANT_NAME="${_value}" ;;
    esac
  done < "${CONFIG_FILE}"
fi

[[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && { log "ERROR: GATEWAY_URL not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && { log "ERROR: CONTROL_PLANE_URL not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && { log "ERROR: TENANT_NAME not set. Fill it in above or check ${CONFIG_FILE}."; exit 1; }

# Persist config for future runs (root-owned, 644, developers cannot edit)
cat > "${CONFIG_FILE}" <<CONF
GATEWAY_URL="${GATEWAY_URL}"
CONTROL_PLANE_URL="${CONTROL_PLANE_URL}"
TENANT_NAME="${TENANT_NAME}"
CONF
chown root:wheel "${CONFIG_FILE}" && chmod 644 "${CONFIG_FILE}"
log "Config saved to ${CONFIG_FILE}."

BINARY_PATH="/usr/local/bin/tfy-local-ai-setup"
RELEASE_TAG="v1.3.4"
RELEASE_BASE="https://github.com/truefoundry/tfy-local-ai-setup/releases/download/${RELEASE_TAG}"
VERSION_FILE="${BINARY_PATH}.version"

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
INSTALLED_TAG="$([[ -f "${VERSION_FILE}" ]] && cat "${VERSION_FILE}" || echo '')"

if [[ ! -f "${BINARY_PATH}" ]] || [[ "${INSTALLED_TAG}" != "${RELEASE_TAG}" ]]; then
  case "$(uname -m)" in
    arm64)  BINARY_URL="${RELEASE_BASE}/tfy-local-ai-setup-darwin-arm64" ;;
    x86_64) BINARY_URL="${RELEASE_BASE}/tfy-local-ai-setup-darwin-amd64" ;;
    *) echo "ERROR: Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
  esac
  log "Installing tfy-local-ai-setup ${RELEASE_TAG} ($(uname -m))..."
  curl -fsSL "${BINARY_URL}" -o "${BINARY_PATH}" && chmod +x "${BINARY_PATH}"
  echo "${RELEASE_TAG}" > "${VERSION_FILE}"
  log "tfy-local-ai-setup installed at ${BINARY_PATH}."
else
  log "tfy-local-ai-setup ${RELEASE_TAG} already installed, skipping download."
fi

# ---------------------------------------------------------------------------
# Run
# ---------------------------------------------------------------------------
exec "${BINARY_PATH}" \
  --codex \
  --url="${CONTROL_PLANE_URL}" \
  --tenant="${TENANT_NAME}" \
  --gateway="${GATEWAY_URL}" \
  ${CODEX_GATEWAY_URL:+--codex-gateway="${CODEX_GATEWAY_URL}"} \
  ${CODEX_AUTH_MODE:+--codex-auth-mode="${CODEX_AUTH_MODE}"} \
  ${CODEX_DEFAULT_MODEL:+--codex-default-model="${CODEX_DEFAULT_MODEL}"} \
  ${CODEX_SETTINGS_FILE:+--codex-settings-file="${CODEX_SETTINGS_FILE}"}

cat /etc/codex/managed_config.toml
ls -lO /etc/codex/managed_config.toml   # expect the "schg" flag