Add boundary support to agent api

[shanewhite97]

Description

Adds optional Agent Boundary (network filtering) support to the agentapi module.
When enable_boundary = true with a user-provided boundary_config, the
module sets up the boundary config and exports AGENTAPI_BOUNDARY_PREFIX for
agent modules to use in their start scripts.

Closes #457

Type of Change

• Feature/enhancement

Module Information

Path: registry/coder/modules/agentapi
Breaking change: No

[shanewhite97]

Proof of tests being completed:

[shanewhite97]

@matifali @zedkipp @evgeniy-scherbina

I believe this is now ready for review, if I have missed anything in the code or as part of the contributing process please just let me know and I will resolve, this is my first contribution.

Also, I was thinking it might be better to remove the Codex changes, and implement those in a separate PR once the new version of AgentAPI with the changes is released. But I will wait for your guidance before proceeding on that.
I will also likely some other modules as well once the agentapi changes are published.

Thanks!

[matifali]

@shanewhite97 We made some changes to how Codex starts in #781. Would be nice to take a look and rebase on main.

[shanewhite97]

@matifali yh I saw those, I think I will remove them out of this PR to keep things simple. Let me do that now.

I will also try to resolve the other pipeline errors

[Copilot]

Pull request overview

Adds optional Coder Boundary network filtering support to the shared agentapi module and wires it through to the Codex module so the Codex CLI can be executed behind boundary (nsjail/landjail), with documentation for how to enable it.

Changes:

• Add new Terraform inputs (enable_boundary, boundary_jail_type, boundary_proxy_port, boundary_config_path) to the agentapi module and pass them into the runtime script.
• Implement boundary setup in agentapi’s main.sh (config generation + exported wrapper) and update Codex start logic to invoke Codex via the wrapper when present.
• Bump the Codex module’s dependency on coder/agentapi to 2.2.0 and document boundary usage in the Codex README.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
registry/coder/modules/agentapi/scripts/main.sh	Adds boundary setup (config + exported wrapper) prior to running the module’s start script.
registry/coder/modules/agentapi/main.tf	Adds boundary-related variables and passes them as script args into main.sh.
registry/coder-labs/modules/codex/scripts/start.sh	Wraps the Codex invocation with BOUNDARY_WRAPPER when boundary is enabled.
registry/coder-labs/modules/codex/main.tf	Exposes boundary variables and forwards them to the agentapi module; bumps agentapi module version.
registry/coder-labs/modules/codex/README.md	Documents how to enable Boundary network filtering for Codex.

[shanewhite97]

@matifali I have added some changes based on the feedback, if you could run another review that would be appreciated :)

[shanewhite97]

@zedkipp Thanks for those suggestions that was really helpful, hopefully they have all been address now but please let me know if anything is not as you would like.
Updated screenshots on tests:

[matifali]

@35C4n0r can you also review the changes here? Thanks

[zedkipp]

@shanewhite97 there's some formatting to fix in the tests (check failed). Would be great to squash these commits down to a single commit with clear commit message before merge. Could be something like:

feat:  provide boundary support for agent modules

Enable any agent module to run its AI agent inside Coder's Agent Boundaries.
The agentapi module handles config setup and wrapper script creation, then
exports AGENTAPI_BOUNDARY_PREFIX for consuming modules to use in their
start scripts.

Users must provide a boundary config.yaml with their allowlist and
settings when enabling boundary.

The boundary related changes look good to me, but I would like @35C4n0r to have the final approval on the changes.

[35C4n0r]

I'll test and review this tommorow 👍

[shanewhite97]

@zedkipp Done the formatting 😄 Are we going to use a single commit message when merging? Or would you like me to do it another way?

[zedkipp]

Before or during merge works fine! Mainly want to ensure this gets merged as a single clear commit.

Lastly, it would be good to test that AGENTAPI_BOUNDARY_PREFIX is indeed set in a module like claude/codex/etc when boundary is enabled in the agentapi module.