Skip to content

feat(engines): launch your own build of an engine with MOSHCODE_ENGINE_BIN_<KEY> - #530

Merged
ralyodio merged 1 commit into
mainfrom
codex-fork-engine
Sep 22, 2026
Merged

ralyodio merged 1 commit into
mainfrom
codex-fork-engine

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Why

Sometimes the copy of an engine that PATH finds first is not the one you mean: a fork carrying a patch upstream has not taken, or a debug build you are bisecting.

The case in hand is codex. openai/codex accepts no external pull requestsdocs/contributing.md says so outright, and GitHub refuses createPullRequest from a fork — so a fix you need has nowhere to land but a build you make yourself. Arrow-key prompt navigation (openai/codex#47300) is one such fix, and without this there is no way to tell moshcode to open it.

What

MOSHCODE_ENGINE_BIN_CODEX=/path/to/codex makes moshcode launch that executable for the codex engine. The same shape works for every engine in the table: the key is the engine name upcased, with anything outside A-Z0-9 replaced by _.

Unset by default, and deliberately so: with no override the engine's declared name is resolved against PATH exactly as before, which is the behaviour every engine documents and every test relies on. An override is a claim to know better than PATH for one engine, so it is only ever made out loud. An empty or whitespace-only value counts as unset rather than as an empty command.

It is applied once where the table is built, not at each launch site, because bin is read directly by the CLI, the TUI's error messages, the swarm and the MCP bridge — an override that only some of them honoured would be worse than none.

Tests

Two added in test/engines.test.mjs:

  • the reader itself, over unset / empty / whitespace / padded / a second engine;
  • a real launch, with a stub codex first on PATH and the override pointing somewhere PATH would never look, asserting the override is what runs and still gets the engine's agent-launch arguments.

run() gained an optional third argument for extra env; existing callers are unchanged.

Full suite: 3132 tests, 2781 pass, 131 fail — byte-identical failure set to main (3130 / 2779 / 131), so no new breakage. Those 131 are pre-existing moshpit contact/DNS cases.


🤖 Generated with Claude Code

…E_BIN_<KEY>

`MOSHCODE_ENGINE_BIN_CODEX=/path/to/codex` makes moshcode open that
executable for the codex engine instead of searching for `codex` on
PATH. The same shape works for every engine in the table.

It exists for the case where you are running your own build of an
engine — a fork carrying a patch upstream has not taken, or a debug
build you are bisecting — and the copy PATH finds first is not the one
you mean. openai/codex, for instance, accepts no external pull requests
at all, so a fix you need has nowhere to land but a fork you build
yourself.

Unset by default, and deliberately so: with no override the engine's
declared name is resolved against PATH exactly as before, which is the
behaviour every engine documents and every test relies on. An override
is a claim to know better than PATH for one engine, so it is only ever
made out loud.

Applied once where the table is built rather than at each launch site,
because `bin` is read directly by the CLI, the TUI's error messages, the
swarm and the MCP bridge, and an override only some of them honoured
would be worse than none.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

1 finding(s) in the 2 file(s) this pull request changes.

MEDIUM: 1

Severity Rule Location
MEDIUM insecure-temp-file test/engines.test.mjs:157
100 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 81 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928

…and 80 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit b253db4 into main Sep 22, 2026
6 checks passed
@ralyodio
ralyodio deleted the codex-fork-engine branch September 22, 2026 16:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants