@bill10/agent-007 0.6.4001 → 0.6.5000

package/.env.example

@@ -46,9 +46,11 @@
 # runs anywhere, and every job-board worker gets a brand-new worktree. By default
 # the app accepts it for board workers (it adds the worktree to ~/.claude.json
 # before the spawn, and answers "Yes" if the dialog still appears), so queued
-# jobs start on their own. A trusted worktree loads that repo's own
-# .claude/settings.json: its hooks run, and its permission allow rules can
-# pre-approve what a strict board mode would ask about. 0/false/off/no keeps
-# the dialog.
+# jobs start on their own. Codex asks the same, and its board workers are
+# started with that one worktree trusted for the run (-c projects=...; nothing
+# is written to ~/.codex/config.toml). A trusted worktree loads that repo's own
+# .claude/settings.json, or Codex's project config, hooks and exec policies:
+# its hooks run, and its permission allow rules can pre-approve what a strict
+# board mode would ask about. 0/false/off/no keeps the dialog for both.
 # Hand-started agents always keep it.
 # TRUST_BOARD_WORKTREES=0

package/README.md

@@ -54,7 +54,7 @@ Uncomment what you want, then restart. The ones people change:
 | `HOST=0.0.0.0` + `ALLOWED_ORIGINS=<tailnet name>` | Reach it from your phone or another machine (behind Tailscale only, see [docs/REMOTE.md](docs/REMOTE.md)) |
 | `CLAUDE_PERMISSION_MODE` | Mode Claude Code agents start in, e.g. `bypassPermissions` |
 | `CODEX_PERMISSION_MODE` | The same for Codex |
-| `TRUST_BOARD_WORKTREES=0` | Keeps Claude Code's folder-trust prompt for job board workers |
+| `TRUST_BOARD_WORKTREES=0` | Keeps Claude Code's and Codex's folder-trust prompt for job board workers |
 | `PORT` | Port to listen on (default `7007`) |
 
 Highest wins: command-line flags (`--port`), then environment variables, then
@@ -121,7 +121,7 @@ ALLOWED_ORIGINS=mac-mini.tailXXXX.ts.net npm start   # Allow a remote browser or
 | `AGENT_MESSAGING` | *(guarded)* | `open` lets any of your agents message any other. By default an agent that asks before acting cannot message one that never asks |
 | `BILLION` | *(on)* | `0` (or `false`/`off`/`no`) turns Billion off. It is also off whenever user accounts exist, since it would belong to everyone |
 | `BILLION_DIR` | `~/.agent-007/billion` | Billion's own folder and git repo. Point it at a new or empty folder |
-| `TRUST_BOARD_WORKTREES` | *(on)* | Board-dispatched Claude Code workers skip the workspace-trust dialog, so queued jobs start unattended. That also lets the repo's own `.claude/settings.json` hooks and permission allow rules apply without asking. `0` (or `false`/`off`/`no`) keeps the dialog. Hand-started agents always keep it |
+| `TRUST_BOARD_WORKTREES` | *(on)* | Board-dispatched Claude Code and Codex workers skip the workspace-trust dialog, so queued jobs start unattended. That also lets the repo's own `.claude/settings.json` (or Codex project config, hooks and exec policies) apply without asking. `0` (or `false`/`off`/`no`) keeps the dialog. Hand-started agents always keep it |
 
 > **Running remotely?** The server spawns real shells, so never expose it to the
 > open internet. See [docs/REMOTE.md](docs/REMOTE.md) for the recommended

package/VERSION

@@ -1 +1 @@
-0.6.4.1
+0.6.5.0

package/bin/agent-007.js

@@ -41,8 +41,8 @@ Settings (default in brackets):
   AGENT_MESSAGING         open = any agent may message any other [guarded]
   BILLION                 0 turns off Billion, the always-on agent [on]
   BILLION_DIR             Billion's folder and repo [~/.agent-007/billion]
-  TRUST_BOARD_WORKTREES   0 keeps Claude Code's folder-trust prompt for job
-                          board workers [on]
+  TRUST_BOARD_WORKTREES   0 keeps Claude Code's and Codex's folder-trust
+                          prompt for job board workers [on]
 
 Set them in the environment, in ~/.agent-007/.env (\`agent-007 init\` writes it,
 every setting explained and commented out), or in a .env in the current

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bill10/agent-007",
-  "version": "0.6.4001",
+  "version": "0.6.5000",
   "description": "From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.",
   "license": "MIT",
   "repository": {

package/server/claude-trust.js

@@ -18,14 +18,26 @@ import { join } from 'path';
 import { sessionAgentFromCommand } from '../lib/jobs.js';
 import { envSwitchOn } from '../lib/helpers.js';
 
-// Board-dispatched Claude Code workers only, and on unless
+// Board-dispatched Claude Code and Codex workers only, and on unless
 // TRUST_BOARD_WORKTREES says otherwise (0/false/off/no). Hand-started agents
 // keep the dialog.
 export function autoTrusts({ spawnedBy, worktreePath, command }, env = process.env) {
-  return spawnedBy === 'board' && !!worktreePath && sessionAgentFromCommand(command) === 'claude'
+  return spawnedBy === 'board' && !!worktreePath && ['claude', 'codex'].includes(sessionAgentFromCommand(command))
     && envSwitchOn(env.TRUST_BOARD_WORKTREES);
 }
 
+// Codex asks "Do you trust the contents of this directory?" in a new worktree
+// too, and records the answer as [projects."<path>"] trust_level in
+// ~/.codex/config.toml. A -c override does the same for this one run and
+// writes nothing: an inline table merges with the user's own [projects]
+// (verified against codex-cli 0.154), and unlike a dotted key it survives the
+// dot in ~/.agent-007. A JSON string is a valid TOML basic string.
+export function codexTrustArgs(folder) {
+  let path = folder;
+  try { path = realpathSync(folder); } catch {}
+  return ['-c', `projects={${JSON.stringify(path)}={trust_level="trusted"}}`];
+}
+
 const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 
 // True when the entry is there afterwards. Never throws. Workers inherit the

package/server/pty.js

@@ -14,6 +14,7 @@ import { broadcastJobs } from './jobs.js';
 import { flushMessages, dropMessages } from './messages.js';
 import { sessionAgentFromCommand, permissionFlagsFromCommand } from '../lib/jobs.js';
 import { trustDialogKey } from './billion.js';
+import { codexTrustArgs } from './claude-trust.js';
 import { dropApprovals } from './approvals.js';
 
 // Regex constants for output filtering (shared, not recreated per event)
@@ -234,7 +235,8 @@ export function createSessionFromConfig({ sessionId, name, color, command, repoP
   // would put a live board credential on disk for terminals that have no way to
   // use it — a plain `bash` tab does not need one.
   const mcpConfigPath = takesMcpConfig(file) ? writeMcpConfig(sessionId, agentToken) : null;
-  const mcpArgs = withMcpConfig(file, args, mcpConfigPath);
+  const codexTrust = autoTrust && sessionAgentFromCommand(command) === 'codex';
+  const mcpArgs = withMcpConfig(file, codexTrust ? [...codexTrustArgs(worktreePath), ...args] : args, mcpConfigPath);
   // A worker on one of Billion's cards asks Billion before it asks a person
   // (server/approvals.js) — where the CLI can be hooked, which today is
   // Claude Code only. Recorded as whether the hook actually went in.
@@ -308,7 +310,7 @@ export function createSessionFromConfig({ sessionId, name, color, command, repoP
     spawnedBy: spawnedBy || 'user',
     jobId: jobId || null,       // job this session was dispatched for, if any
     isBillion: !!isBillion,     // the one agent you talk to (server/billion.js)
-    answersTrust: !!(isBillion || autoTrust),   // see answerTrustDialog
+    answersTrust: !!(isBillion || (autoTrust && !codexTrust)),   // see answerTrustDialog; Codex's flag leaves nothing to answer
     approvalsToBillion: hooked, // its permission dialogs go to Billion first
     exited: false,
     stateCheckInterval: null,

package/server.js

@@ -32,7 +32,7 @@ import { setupRoutes } from './server/http.js';
 import { startDispatcher, stopDispatcher, boardSettings } from './server/jobs.js';
 import { orphans, config } from './server/state.js';
 import { sweepMcpConfigs } from './server/agent-mcp.js';
-import { withDefaultPermission, envPermissionMode, PERMISSION_MODES, ENV_PERMISSION_MODE } from './lib/jobs.js';
+import { withDefaultPermission, envPermissionMode, PERMISSION_MODES, ENV_PERMISSION_MODE, sessionAgentFromCommand } from './lib/jobs.js';
 import { BILLION_NAME, billionEnabled, billionRuns, billionDir, ensureBillionRepo, refreshCharter, suggestProjectsDir, billionCommand, noClaudeCommand } from './server/billion.js';
 import { commandExists, missingCommandMessage } from './server/command-path.js';
 import { parseCommand } from './lib/helpers.js';
@@ -100,8 +100,9 @@ async function createSession(command, name, repoPath, customBranch, ownerId, met
 
   // A board worker's worktree is brand new, so Claude Code would stop at its
   // workspace-trust dialog until someone clicked (server/claude-trust.js).
+  // Codex's is skipped by a flag instead (server/pty.js).
   const autoTrust = autoTrusts({ spawnedBy: meta.spawnedBy, worktreePath, command });
-  if (autoTrust) trustClaudeFolder(worktreePath);
+  if (autoTrust && sessionAgentFromCommand(command) === 'claude') trustClaudeFolder(worktreePath);
 
   const result = createSessionFromConfig({
     sessionId, name: agentName, color, command,