ipc fix; claude code fix; new config edit feature

[thecodeassassin]

1. Claude Code musl compatibility fallback (claude.go)

• Claude Code v2.1.63 ships a broken musl binary (posix_getdents: symbol not found), breaking all Alpine-based builds -
  [BUG] v2.1.63 crashes on Alpine Linux (musl): posix_getdents symbol not found anthropics/claude-code#29559
• Added pre-install compatibility check: binary is tested with --version before running install
• Automatic fallback: walks back up to 5 patch versions until a working binary is found
• Added ARG CLAUDE_VERSION build arg for explicit version pinning

2. Codex seccomp sandbox compatibility (base.go, embed.go, exitbox-allow-ipc.py)

• Codex's seccomp sandbox blocks Unix socket connect() for /bin/sh child processes
• Added Python IPC fallback: exitbox-allow now tries Go binary first, falls back to Python
• Added standalone exitbox-allow-ipc.py for direct invocation when both Go and shell wrapper are blocked
• Go binary renamed to exitbox-allow-bin; wrapper script becomes exitbox-allow

3. Codex approval rules injection (docker-entrypoint)

• Auto-generates .codex/rules/exitbox.rules with Starlark prefix_rule() directives
• Pre-approves exitbox-allow, exitbox-vault, and exitbox-kv commands so Codex can use them without manual approval

4. exitbox config command group (config_cmd.go, import_cmd.go deleted)

• exitbox import moved to exitbox config import (same behavior)
• New exitbox config edit — opens agent's primary config file in $EDITOR
• Added ConfigFilePath(wsDir) to Agent interface (claude: settings.json, codex: config.toml, opencode: opencode.json)

5. IPC server deadlock fix (server.go, handler_allow.go)

• Split single mu mutex into mu (handler map) + promptMu (prompt serialization)
• Prevents a hung tmux popup from blocking all IPC operations (vault, kv)
• Added 30-second timeout on tmux popup prompts to prevent indefinite deadlocks

6. Env var reservation fix (run.go)

• OLLAMA_HOST, ANTHROPIC_BASE_URL, ANTHROPIC_API_KEY, OPENAI_BASE_URL are no longer unconditionally reserved
• Now only conflict when --ollama flag is active, allowing custom API endpoint configuration otherwise

7. Better exitbox-allow error messages (cmd/exitbox-allow/main.go)

• Distinguishes "socket missing" from "socket exists but connect failed"
• Helps diagnose stale bind-mount scenarios (container outliving host process)

8. Sandbox instructions update (docker-entrypoint)

• Added go install to the list of blocked package manager commands

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/Cloud-Exit/ExitBox/cmd	0.00% (ø)
github.com/Cloud-Exit/ExitBox/cmd/exitbox-allow	0.00% (ø)
github.com/Cloud-Exit/ExitBox/internal/agent	0.00% (ø)
github.com/Cloud-Exit/ExitBox/internal/config	0.00% (ø)
github.com/Cloud-Exit/ExitBox/internal/image	0.00% (ø)
github.com/Cloud-Exit/ExitBox/internal/ipc	0.00% (ø)
github.com/Cloud-Exit/ExitBox/internal/run	0.00% (ø)
github.com/Cloud-Exit/ExitBox/static	0.00% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/Cloud-Exit/ExitBox/cmd/config_cmd.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/cmd/exitbox-allow/main.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/cmd/import_cmd.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/cmd/rebuild.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/cmd/run.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/agent/agent.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/agent/claude.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/agent/codex.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/agent/opencode.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/config/types.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/image/base.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/image/core.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/image/tools.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/ipc/handler_allow.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/ipc/server.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/internal/run/run.go	0.00% (ø)	0	0	0
github.com/Cloud-Exit/ExitBox/static/embed.go	0.00% (ø)	0	0	0

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/Cloud-Exit/ExitBox/cmd/run_flags_test.go
• github.com/Cloud-Exit/ExitBox/internal/agent/agent_test.go
• github.com/Cloud-Exit/ExitBox/internal/config/types_test.go