fix: preflight codex stdio mount resources

scripts/src/dev-cd-apply.test.mjs

@@ -236,7 +236,11 @@ function makeRunCommand({
   secretRefs = {
     "hwlab-cloud-api-dev-db": ["database-url"],
     "hwlab-cloud-api-dev-db-admin": ["admin-url"],
-    "hwlab-code-agent-provider": ["openai-api-key"]
+    "hwlab-code-agent-provider": ["openai-api-key"],
+    "hwlab-code-agent-codex-auth": ["auth.json"]
+  },
+  configMaps = {
+    "hwlab-code-agent-codex-config": ["config.toml"]
   }
 } = {}) {
   let lease = heldLock ? leaseFromLock(heldLock) : null;
@@ -314,6 +318,17 @@ function makeRunCommand({
         stderr: ""
       };
     }
+    if (command.includes("kubectl") && args.includes("get") && args.includes("configmap")) {
+      const name = args[args.indexOf("configmap") + 1];
+      const keys = configMaps[name];
+      if (!keys) {
+        return { code: 1, stdout: "", stderr: `Error from server (NotFound): configmaps "${name}" not found` };
+      }
+      if (args.some((arg) => String(arg).startsWith("go-template="))) {
+        return { code: 0, stdout: `${keys.join("\n")}\n`, stderr: "" };
+      }
+      return { code: 0, stdout: `configmap/${name}\n`, stderr: "" };
+    }
     if (command.includes("kubectl") && args.includes("get") && args.includes("lease")) {
       if (!lease) return { code: 1, stdout: "", stderr: "Error from server (NotFound): leases.coordination.k8s.io \"hwlab-dev-cd-lock\" not found" };
       return { code: 0, stdout: `${JSON.stringify(lease)}\n`, stderr: "" };
@@ -1169,11 +1184,18 @@ test("apply preflight passes with D601 native k3s and required SecretRef keys be
     [
       "hwlab-cloud-api-dev-db/database-url:present",
       "hwlab-cloud-api-dev-db-admin/admin-url:present",
-      "hwlab-code-agent-provider/openai-api-key:present"
+      "hwlab-code-agent-provider/openai-api-key:present",
+      "hwlab-code-agent-codex-auth/auth.json:present"
     ]
   );
+  assert.deepEqual(
+    preflight.configMaps.map((ref) => `${ref.configMapName}/${ref.configMapKey}:${ref.status}`),
+    ["hwlab-code-agent-codex-config/config.toml:present"]
+  );
   assert.equal(preflight.safety.secretValuesRead, false);
   assert.equal(preflight.safety.secretValuesPrinted, false);
+  assert.equal(preflight.safety.configMapValuesRead, false);
+  assert.equal(preflight.safety.configMapValuesPrinted, false);
 
   const firstWriteIndex = commandLog.findIndex((entry) =>
     entry.command.includes("kubectl") && ["create", "replace", "apply", "patch", "delete", "rollout", "wait", "logs"].some((verb) => entry.args.includes(verb))
@@ -1206,7 +1228,8 @@ test("apply preflight blocks missing SecretRef before Lease or side-effect comma
       commandLog,
       secretRefs: {
         "hwlab-cloud-api-dev-db": ["database-url"],
-        "hwlab-cloud-api-dev-db-admin": ["admin-url"]
+        "hwlab-cloud-api-dev-db-admin": ["admin-url"],
+        "hwlab-code-agent-codex-auth": ["auth.json"]
       }
     }),
     httpGetJson: makeHttpGetJson(),
@@ -1227,6 +1250,42 @@ test("apply preflight blocks missing SecretRef before Lease or side-effect comma
   assertNoWriteSideEffects(commandLog);
 });
 
+test("apply preflight blocks missing Codex ConfigMap before Lease or workload apply", async () => {
+  const repoRoot = await makeRepo();
+  const commandLog = [];
+  let output = "";
+  const code = await runDevCdApply([
+    "--apply",
+    "--confirm-dev",
+    "--confirmed-non-production",
+    "--owner-task-id",
+    "task-missing-codex-config",
+    "--kubeconfig",
+    "/etc/rancher/k3s/k3s.yaml",
+    "--report", stateReport(repoRoot, "dev-cd-apply.json")
+  ], {
+    repoRoot,
+    env: {},
+    runCommand: makeRunCommand({
+      commandLog,
+      configMaps: {}
+    }),
+    httpGetJson: makeHttpGetJson(),
+    now: () => new Date(iso(100000)),
+    stdout: { write: (chunk) => { output += chunk; } }
+  });
+
+  const summary = JSON.parse(output);
+  const writtenReport = JSON.parse(await readFile(stateReport(repoRoot, "dev-cd-apply.json"), "utf8"));
+  assert.equal(code, 2);
+  assert.equal(summary.status, "blocked");
+  assert.equal(summary.preflight.status, "blocked");
+  assert.equal(summary.blockers.some((blocker) => blocker.scope === "configmap:hwlab-code-agent-codex-config/config.toml"), true);
+  assert.equal(writtenReport.devCdApply.preflight.safety.writeSideEffectsAttempted, false);
+  assert.equal(writtenReport.devCdApply.preflight.safety.configMapValuesPrinted, false);
+  assertNoWriteSideEffects(commandLog);
+});
+
 test("apply preflight blocks non-D601 kubeconfig path before kubectl mutation", async () => {
   const repoRoot = await makeRepo();
   const commandLog = [];