chore: import upstream snapshot with attribution

examples/openai-codex-sdk/bedrock/README.md

@@ -0,0 +1,59 @@
+# openai-codex-sdk/bedrock (Codex SDK on Amazon Bedrock)
+
+Runs OpenAI's Codex coding agent against OpenAI frontier models hosted on **Amazon Bedrock**
+(`openai.gpt-5.5` / `openai.gpt-5.4`) instead of the OpenAI Platform.
+
+You can run this example with:
+
+```bash
+npx promptfoo@latest init --example openai-codex-sdk/bedrock
+```
+
+## Prerequisites
+
+1. Install the Codex SDK:
+
+   ```bash
+   npm install @openai/codex-sdk
+   ```
+
+2. Request access to the OpenAI frontier models in a supported AWS Region:
+   - GPT-5.5: `us-east-2`
+   - GPT-5.4: `us-east-2`, `us-west-2`
+
+3. Export AWS credentials (the Codex CLI reads them from its environment):
+
+   ```bash
+   export AWS_ACCESS_KEY_ID="your_access_key"
+   export AWS_SECRET_ACCESS_KEY="your_secret_key"
+   ```
+
+## How it works
+
+- `model_provider: amazon-bedrock` routes Codex through Bedrock's OpenAI-compatible
+  endpoint (`https://bedrock-mantle.<region>.api.aws/openai/v1`).
+- `model: openai.gpt-5.5` uses the Bedrock model id (note the `openai.` prefix).
+- AWS credentials and `AWS_REGION` are forwarded to the Codex CLI via `cli_env` because
+  promptfoo runs the CLI with a minimal environment by default. You may instead set
+  `AWS_BEARER_TOKEN_BEDROCK` (a Bedrock API key), `AWS_PROFILE`, or
+  `inherit_process_env: true`. If you use temporary credentials (SSO / STS / assumed
+  roles / MFA), also forward `AWS_SESSION_TOKEN` (uncomment it in the config).
+
+> **Security note:** values placed in `cli_env` are exposed to the Codex agent's shell
+> environment. Scope the IAM permissions to Bedrock inference and prefer short-lived
+> credentials.
+
+> **Heads up:** export the AWS credentials before running. If `AWS_ACCESS_KEY_ID` /
+> `AWS_SECRET_ACCESS_KEY` are unset, the unresolved `{{env.*}}` template is forwarded to the
+> Codex CLI verbatim, and you'll get an opaque AWS auth error (e.g. `UnrecognizedClientException`)
+> rather than a clear "credentials not set" message.
+
+For direct (non-agentic) inference against the same models, use the
+[`bedrock:` provider](https://www.promptfoo.dev/docs/providers/aws-bedrock/#openai-models)
+(`bedrock:openai.gpt-5.5`).
+
+## Run it
+
+```bash
+promptfoo eval -c examples/openai-codex-sdk/bedrock/promptfooconfig.yaml
+```

examples/openai-codex-sdk/bedrock/promptfooconfig.yaml

@@ -0,0 +1,34 @@
+# yaml-language-server: $schema=https://promptfoo.dev/config-schema.json
+description: 'Codex SDK running OpenAI frontier models on Amazon Bedrock'
+
+prompts:
+  - 'Write a Python function that calculates the factorial of a number. Output only the code.'
+
+providers:
+  # GPT-5.5 on Bedrock (us-east-2). Codex routes through Bedrock's OpenAI-compatible
+  # endpoint, so the model id uses the openai. prefix.
+  - id: openai:codex-sdk
+    label: codex-gpt-5.5-bedrock
+    config:
+      model: openai.gpt-5.5
+      model_provider: amazon-bedrock
+      model_reasoning_effort: low
+      sandbox_mode: read-only
+      skip_git_repo_check: true
+      # The Codex CLI reads AWS credentials from its own environment. promptfoo runs
+      # the CLI with a minimal env by default, so forward credentials + region here.
+      cli_env:
+        AWS_REGION: us-east-2
+        AWS_ACCESS_KEY_ID: '{{env.AWS_ACCESS_KEY_ID}}'
+        AWS_SECRET_ACCESS_KEY: '{{env.AWS_SECRET_ACCESS_KEY}}'
+        # Using temporary credentials (SSO / STS / assumed role / MFA)? Also forward the
+        # session token (leave it out for long-lived IAM keys):
+        # AWS_SESSION_TOKEN: '{{env.AWS_SESSION_TOKEN}}'
+        # Or authenticate another way instead of static keys — forward one of:
+        # AWS_BEARER_TOKEN_BEDROCK: '{{env.AWS_BEARER_TOKEN_BEDROCK}}' # a Bedrock API key
+        # AWS_PROFILE: '{{env.AWS_PROFILE}}'                           # a named profile
+
+tests:
+  - assert:
+      - type: contains
+        value: 'def factorial'