public-demo-sessionlisted

# Public Demo Session Use this skill when the goal is a public recording, README demo, screenshot, or clean transcript. The priority is a short, reliable demo surface, not exhaustive orchestration. ## Goals - Show only a public-safe workspace path such as `/llm-cli-gateway`. - Keep the llm-cli-gateway MCP server and workspace skills available. - Prefer direct, synchronous provider calls that return compact text. - Avoid validation wrappers, async polling, nested Codex, and repeated stuck-job polling unless the user explicitly asks for those features. ## Path Hygiene Do not start Codex directly from an internal checkout path for public demos. A symlink may still leak a resolved path in some tools. Prefer a bind-mounted public path: ```bash bwrap \ --bind "$REAL_REPO" /llm-cli-gateway \ --chdir /llm-cli-gateway \ --setenv CODEX_HOME "$DEMO_CODEX_HOME" \ codex --dangerously-bypass-approvals-and-sandbox ``` If the host needs Codex HTTPS/WebSocket support inside the mount namespace, bind the host CA backing store too. On this host `/etc/ssl/certs` depends on `/var/lib/ca-certificates`. The demo `CODEX_HOME` should have a minimal `config.toml` with: ```toml model = "gpt-5.5" model_reasoning_effort = "high" project_doc_max_bytes = 0 [projects."/llm-cli-gateway"] trust_level = "trusted" [mcp_servers.llm-gateway] command = "node" args = ["/llm-cli-gateway/dist/index.js"] ``` Keep the demo home separate from the normal Codex home. Symlink `auth.json` from the normal