On 2026-09-15 Julian explicitly requested automatic sudo codex startup after SSH login, automatic updates without repeated approval, and return to the console when Codex closes. Scope: the ax_julian host login and the existing global Codex CLI installation. Existing passwordless sudo already permits this; no sudoers changes were made.
/home/ax_julian/.bash_profile sources the existing .profile, then starts Codex only for an interactive SSH login with a terminal. Non-interactive SSH commands bypass it.CODEX_SSH_STARTED=1 prevents repeated startup in nested login shells. CODEX_NO_AUTOSTART=1 bypasses startup./usr/local/sbin/codex-ssh-chat is root-owned, mode 0755. Its versioned source is ops-tools/maintenance/codex-ssh-chat in the host home repository. It uses the root Codex profile, preserving existing root authentication and settings.codex update with stdin closed before each chat. This installation is npm-managed. Updates are serialized with /run/lock/codex-ssh-update.lock, bounded to 120 seconds plus 5 seconds termination grace; lock acquisition waits at most 130 seconds. Failed updates warn and attempt the installed CLI. A failed chat launch returns to the shell.check_for_update_on_startup=false, because the preceding native update already manages updates. General command-approval settings are unchanged. Updating the package does not restart existing chats.Use /exit in Codex to return to the existing user shell. To bypass autostart from another terminal: ssh -t HOST 'CODEX_NO_AUTOSTART=1 bash -l'.
To disable autostart persistently, add export CODEX_NO_AUTOSTART=1 to the user's existing .profile; the new .bash_profile reads it before evaluating the hook. No SSH daemon changes are required.
Native codex update completed without input and the installed version reports codex-cli 0.154.0. Root codex login status reports ChatGPT authentication. Shell syntax, installed/source equality, ownership, non-interactive login and bypass checks passed. A pseudo-terminal running the actual ax_julian login shell with SSH environment opened the real Codex chat using the existing root model/profile. The real /exit command returned to the existing shell, where id -u confirmed ax_julian (1240000004). The two configuration files are committed locally as 0ef2442 on host/codex-ssh-autostart-2026-09-15; this repository has no remote. This exercises the login startup path; a new network SSH connection has not been verified.