Codex via npm (@openai/codex); Grok via the official x.ai installer, symlinked onto the global PATH with a grok --version build check that fails loudly if the arm64 binary didn't land.
containerSpec() now seeds auth per backend: both store auth as plain files (no Keychain), so seedAgentHome copies the host's ~/.codex / ~/.grok into the per-session writable home (the agent's $HOME), where the CLIs find $HOME/.codex / $HOME/.grok automatically. API-key users are covered by forwarding OPENAI_API_KEY / XAI_API_KEY / GROK_CODE_XAI_API_KEY.
Completes the binaries + auth for the gated Grok/Codex control-container exec path. See docs/VSOCK_CONTROL_PLANE.md.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
